Node.js: Node.js: Trust-policy bypass due to hostname matching inconsistency

A flaw was found in Node.js. An inconsistency in how Node.js matches hostnames can be exploited by a remote attacker in multi-context mTLS mutual Transport Layer Security setups. This vulnerability allows for a trust-policy bypass, potentially leading to unauthorized access to sensitive informati...

nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling

A flaw was found in Node.js. This vulnerability in the TLS Transport Layer Security hostname handling allows embedded null characters in hostnames. This can lead to silent authority rebinding, potentially enabling an attacker to redirect network traffic to an unintended server and disclose...

SUSE-SU-2026:22763-1 Security update for the Linux Kernel (Live Patch 11 for SUSE Linux Enterprise 16)

This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.32.1 fixes various security issues The following security issues were fixed: - CVE-2026-31505: iavf: fix out-of-bounds writes in iavfgetethtoolstats bsc1263094. - CVE-2026-31533: net/tls: fix use-after-free in -EBUSY error path of...

TencentOS Server 3: container-tools:rhel8 (TSSA-2026:0671)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0671 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities...

Medium: golang-github-cpuguy83-md2man

Issue Overview: On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /. For example, 'root.Open"symlink/"' will open "symlink" even when "symlink" is a symboli...

MAL-2026-10943 Malicious code in aftermathfi (npm)

The aftermathfi package was published to the npm registry by user 'jet0010001' maintainer email [email protected] as part of a dependency-confusion / reconnaissance campaign impersonating the Aftermath Finance SDK Aftermath Finance is a DeFi protocol on the Sui blockchain. The package was...

Malicious code in aftermathfi (npm)

The aftermathfi package was published to the npm registry by user 'jet0010001' maintainer email [email protected] as part of a dependency-confusion / reconnaissance campaign impersonating the Aftermath Finance SDK Aftermath Finance is a DeFi protocol on the Sui blockchain. The package was...

Linux Distros Unpatched Vulnerability : CVE-2026-64046

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net: tls: prevent chain-after-chain in plain text SG Sashiko points out that if end = 0 start != 0 the current code will create a chain link to content type rig...

RockyLinux 8 : nodejs:22 (RLSA-2026:41947)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:41947 advisory. ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input CVE-2026-42338 undici: undici: Denial of Service due to...

Medium: php8.3

Issue Overview: PHP: Failure to setup TLS with a remote server can result in a remote DoS CVE-2026-12184 PHP: ext/openssl: Memory corruption zendmmheap corrupted in opensslencrypt with AES-WRAP-PAD CVE-2026-14355 Affected Packages: php8.3 Issue Correction: Run dnf update php8.3 --releasever...

Amazon Linux 2023 : golang-github-burntsushi-toml, golang-github-burntsushi-toml-devel (ALAS2023-2026-1978)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1978 advisory. On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /...

Linux Distros Unpatched Vulnerability : CVE-2026-64047

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net: tls: fix off-by-one in sgchain entry count for wrapped skmsg ring When an skmsg scatterlist ring wraps sg.end sg.datamsgpl-sg.start, MAXSKBFRAGS -...

Amazon Linux 2023 : php8.3, php8.3-bcmath, php8.3-cli (ALAS2023-2026-1961)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1961 advisory. PHP: Failure to setup TLS with a remote server can result in a remote DoS CVE-2026-12184 PHP: ext/openssl: Memory corruption zendmmheap corrupted in opensslencrypt with AES-WRAP-PAD...

Linux Distros Unpatched Vulnerability : CVE-2026-64025

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - bpf, skmsg: fix verdict skdataready racing with ktls rx skpsockstrpdataready already checks tlsswhasctxrx and defers to psock-saveddataready when a TLS RX conte...

Malicious code in aftermath-finance (npm)

The aftermath-finance package was published to the npm registry by user 'jet0010001' maintainer email [email protected] as part of a dependency-confusion / reconnaissance campaign impersonating the Aftermath Finance SDK Aftermath Finance is a DeFi protocol on the Sui blockchain. The package...

glibc security update

2.39-126.0.1 - Forward port Oracle changes to 2.39-126. - Reviewed-by: Jose E. Marchesi Oracle history: Jul-15-2026 Cupertino Miranda - 2.39-124.0.1 - Forward port Oracle changes to 2.39-124. - Reviewed-by: Jose E. Marchesi May-19-2026 Cupertino Miranda - 2.39-121.0.1 - Forward port Oracle change...

RHEL 8 : nodejs:22 (RHSA-2026:41947)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:41947 advisory. Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language...

SUSE CVE-2026-63830

In the Linux kernel, the following vulnerability has been resolved: net: skmsg: preserve sg.copy across SG transforms The skmsg sg.copy bitmap is part of the scatterlist entry ownership state. A set bit tells skmsgcomputedatapointers not to expose the entry through writable BPF ctx-data. This...

CVE-2026-64047

In the Linux kernel, the following vulnerability has been resolved: net: tls: fix off-by-one in sgchain entry count for wrapped skmsg ring When an skmsg scatterlist ring wraps sg.end sg.datamsgpl-sg.start, MAXSKBFRAGS - msgpl-sg.start + 1, msgpl-sg.data; This places the chain pointer at...

CVE-2026-64046 net: tls: prevent chain-after-chain in plain text SG

In the Linux kernel, the following vulnerability has been resolved: net: tls: prevent chain-after-chain in plain text SG Sashiko points out that if end = 0 start != 0 the current code will create a chain link to content type right after the wrap link: This would create a chain where the wrap link...